China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants

Source: CSO Online · OCT 22, 2026

A China-state-aligned threat actor compromised a ConnectWise cloud backup application and used an open-source agentic AI framework to turn its stolen credentials against more than 2,250 Microsoft 365 tenants, Microsoft said. Microsoft Threat Intelligence attributed the activity to Storm-0940, which it said has used the ARTEX framework since as early as September 2026 to automate attacks on hundreds of organizations. In some cases, the group gained privileged cloud access less than three hours after first targeting a victim. Microsoft said the activity did not result from a compromise of or vulnerability in its own systems, products, or services. “This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially,” Microsoft said in a blog post. Machine-speed sign-ins Following the breach at ConnectWise, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants at 2,900 att